A simple built-in camera cover is not a cosmetic doodad. And physical covers cannot be remotely hacked, unlike the active camera light which has been overridden multiple times.
If we're talking about focusing on security, then the choice should be clear.
The other comment says there are dozens in this thread...I haven't seen anything specific mentioned. But, I remember reading something a year or two ago[1] that's not solidly sourced (it'd be great if Apple posted something on their website like they did about microphones [2])
> All cameras after that one were different: The hardware team tied the LED to a hardware signal from the sensor: If the (I believe) vertical sync was active, the LED would light up. There is NO firmware control to disable/enable the LED. The actual firmware is indeed flashable, but the part is not a generic part and there are mechanisms in place to verify the image being flashed. […]
"You know the camera was on" is not the same as "the camera can't see anything because the cover was on", the same way as notifying the user of a security failure is not the same as preventing it in the first place.
If we're talking about focusing on security, then the choice should be clear.